nvidia linux binary driver priv escalation exploit

Dave Airlie <airlied <at> gmail.com>
2012-08-01 00:10:30 GMT

First up I didn't write this but I have executed it and it did work here,
I was given this anonymously, it has been sent to nvidia over a month
ago with no reply or advisory and the original author wishes to remain
anonymous but would like to have the exploit published at this time,
so I said I'd post it for them.
It basically abuses the fact that the /dev/nvidia0 device accept
changes to the VGA window and moves the window around until it can
read/write to somewhere useful in physical RAM, then it just does an
priv escalation by writing directly to kernel memory.
Dave.